ClawHub
Back to skill

Security audit

aegis-security-tool-free

Security checks for vulnerabilities and agentic risk

Overview

It performs the advertised blockchain checks, but it also recommends sending a machine-identifying fingerprint with wallet lookups to an external service, so users should review it carefully before installing.

Install only if you are comfortable sending the addresses, tokens, chain IDs, and quota identifiers you check to the skill's external API. Do not use a fingerprint based on your username or hostname; prefer an anonymous, rotatable identifier, and confirm outbound calls before running batch checks or using it outside blockchain-specific tasks.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:243
Finding

Local Username and Hostname Disclosed as a Client Fingerprint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 243–246
Vulnerability Type: Privacy-sensitive environment information disclosure
Risk Level: Medium

Complete Code Snippet:

bash
# 在请求头中设置指纹
FINGERPRINT="user-$(whoami)-$(hostname)"
# ...
curl -s -H "X-Client-Fingerprint: ${FINGERPRINT}" \
  "https://aegis402.chain_id=1"

Technical Analysis

The Skill instructs the agent to execute whoami and hostname, combine the results into a stable client fingerprint, and include that value in an outbound HTTP header. A local username and hostname may reveal a person's identity, organization, device role, internal naming convention, or infrastructure details. They are not required to perform a blockchain address or token risk assessment.

The destination shown in the command is malformed and inconsistent with the separately documented api.example.com dependency. The command will generally fail as written, so the audit does not establish successful disclosure to an operating service. Nevertheless, the documented workflow creates an unsafe disclosure pattern: if the destination resolves in a particular environment or the example is repaired without changing the fingerprint logic, local identifiers will be transmitted externally. A stable value also enables correlation of requests over time.

Attack Path

  1. A user asks the agent to follow the Skill's client-fingerprint example.
  2. The agent executes whoami and obtains the local account name.
  3. The agent executes hostname and obtains the device or host name.
  4. Both identifiers are concatenated into FINGERPRINT.
  5. curl places the value in the X-Client-Fingerprint request header.
  6. If the configured destination resolves and accepts the request, the remote operator receives the local identifiers and can correlate subsequent requests using the stable value.

Impact Assessment

This issue does not grant local code execution, ...[truncated 427 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all use of whoami and hostname when constructing request identifiers.
  2. Omit the fingerprint header unless it is strictly necessary for the service.
  3. If a client identifier is required, generate a random, pseudonymous identifier that contains no environment-derived data. Store it only with informed user consent and provide a way to rotate or delete it.
  4. Clearly disclose what information is transmitted, why it is required, how long it is retained, and whether it is used for tracking.
  5. Replace malformed and placeholder destinations with one documented, verified HTTPS API origin.
  6. Require explicit user confirmation before transmitting any local metadata to an external service.
  7. Validate the destination against an allowlist and avoid following redirects to untrusted origins.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Requesting exec for a skill whose primary purpose is simple API-based reputation checking unnecessarily expands the attack surface. In an agent environment, shell access can be abused to run arbitrary local commands, access local files, or chain network operations beyond the user's intended blockchain lookup.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This section instructs the agent or user to transmit blockchain addresses to an external API endpoint. External transmission is expected for a hosted reputation-check service, but it is still security-relevant because wallet addresses and associated query patterns may be sensitive and are sent off-platform.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
# 查询以太坊地址信誉
curl -s "https://api.example.com/v1/check-address/0x742d35Cc6634C0532925a3b844Bc454e4438f44e?chain_id=1" | jq
# ...
# 查询Base链地址信誉

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description limits the skill to address reputation queries, token safety checks, and free/pro comparison. However, the documentation states this capability supports '创建/查询/导出操作', which expands the behavior from simple security checking into broader CRUD/export workflows not described in the manifest. That is a semantic scope mismatch rather than an implementation detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a personal-use blockchain scanning tool centered on reputation and token safety inspection. Declaring that token checks support '创建/查询/导出操作' implies broader operational functionality than passive security analysis, especially 'create', which is not part of the stated purpose. This creates a description-versus-behavior mismatch in the skill documentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

A quota lookup is a read-only support function for the free security scanner. Saying it supports '创建/查询/导出操作' materially broadens the implied behavior beyond the manifest's description of lightweight address/token checking and plan comparison. The mismatch is especially notable because 'create' has no evident relation to checking remaining quota.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The token-check example sends user-supplied token identifiers to an external endpoint, exposing transaction-interest metadata and potentially sensitive analysis targets. In agent contexts, this can leak what assets a user is considering trading or investigating.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
CHAIN_ID=1
# ...
echo "正在检查代币安全性..."
RESULT=$(curl -s "https://api.example.com/v1/check-${PARAM}/${ITEM_ADDRESS}?chain_id=${CHAIN_ID}")
# ...
RISK_LEVEL=$(echo "$RESULT" | jq -r '.risk_level')
IS_SAFE=$(echo "$RESULT" | jq -r '.is_safe')

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The batch-query example increases the privacy and operational risk of external transmission by sending multiple addresses in sequence, enabling profiling of a user's portfolio, watchlist, or investigation set. Repeated automated requests can also amplify rate-limit or service-abuse consequences.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md
)
# ...
for addr in "${ADDRESSES[@]}"; do
    RISK=$(curl -s "https://api.example.com/v1/check-address/${addr}?chain_id=${CHAIN_ID}" | jq -r '.risk_level')
    echo "${addr} -> ${RISK}"
    sleep 1  # 免费版限速,每次间隔1秒
done

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are broad enough to match generic security, compliance, scanning, or encryption requests unrelated to blockchain address or token checks. In an agent platform, this can cause unintended invocation, leading the skill to collect inputs, suggest shell/network actions, or influence workflows outside its legitimate scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

领先步:验证服务可用性

bash
curl -s https://api.example.com/health

第二步:查询免费额度

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill recommends constructing a stable fingerprint from whoami and hostname and sending it to an external service, which exposes persistent local identity metadata without a clear privacy notice or minimization controls. This can enable cross-session tracking, environment correlation, and unintentional disclosure of usernames or host naming conventions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The usage-query example transmits a persistent X-Client-Fingerprint to an external service, creating a trackable identity across requests. Combined with free-tier accounting, this enables durable behavioral profiling tied to local environment-derived identifiers.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md
echo "链 ID: ${chain}"
# ...
    # 查询额度
    USAGE=$(curl -s -H "X-Client-Fingerprint: ${fingerprint}" "https://api.example.com/v1/usage")
    REMAINING=$(echo "$USAGE" | jq -r '.freeTier.remainingChecks')
    echo "剩余免费额度: ${REMAINING}"
# ...

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This address-check flow combines external transmission of the target blockchain address with the persistent client fingerprint, allowing the remote service to correlate specific lookups to a stable client identity. That raises the sensitivity beyond ordinary API use because both user interest and environment-linked metadata are exposed together.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
# ...
    # 地址检查
    RESULT=$(curl -s -H "X-Client-Fingerprint: ${fingerprint}" \
        "https://api.example.com/v1/check-address/${to_addr}?chain_id=${chain}")
# ...
    echo "地址风险等级: ${RISK}"
# ...

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The display name, summary, description, and the full instructional content are presented in Chinese, while the skill metadata does not indicate that it is intentionally limited to Chinese-speaking users or a region-specific context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.